Privacy Policy

1. Who is the data controller

For your account data (if you're a professional or clinic with a Nerela account — name, email, billing details for your subscription) and for the data of people who visit our websites (nerela.eu and nerela.lat), the data controller is LAGASTROEMIA VENTURES OÜ, with its registered office at Sakala tn 7-2, Kesklinna linnaosa, 10141 Tallinn, Estonia, VAT identification number EE102418024. You can contact us about any data protection matter at admin@nerela.eu.

For the data on patients that a professional enters into the App (patient records, session notes, appointments), the data controller is the professional or clinic themselves — they decide what data to collect and why. Nerela acts here as a processor, handling that data only to provide the service and in line with the professional's instructions, never for our own purposes.

2. What data we process

• Professional account data: name, email, phone number, account type (independent/clinic), preferred language.
• Subscription billing data: tax ID, billing address, IBAN (for your own Nerela plan).
• Patient data entered by the professional: name, contact details (email/phone), address, appointment data, and — the most sensitive category — clinical session notes.
• Minimal technical data: server access and error logs, scrubbed as described in section 9.
• Data of people who visit our websites (nerela.eu and nerela.lat): the campaign or link you arrived from and, only if you accept advertising, browser identifiers and visit events (viewing the page, pressing the sign-up button or the WhatsApp button), as described in section 11.
• Only if you accepted marketing cookies on our public website: the data we send to Meta when you create your account (your email and phone number turned into an irreversible fingerprint — a SHA-256 hash —, your IP address, your browser's user agent, and the Meta identifiers of your browser and of your click). It includes no patient data.

3. Health data: legal basis and special care

Session notes and any clinical information are "special category data" under Article 9 of the GDPR. The professional (as controller in relation to their patient) must ensure there's a valid legal basis — typically the patient's explicit consent, or the necessity of their own therapeutic care (Article 9(2)(a) or (h)).

On our side, we protect that data with technical isolation per professional (Row Level Security in Supabase — each professional can only access their own patients at database level) and with the scrubbing policy in our error monitoring described in section 9.

4. Purposes and legal basis for processing

• Providing the service (calendar, records, notes, invoicing, online booking) — performance of our contract with you.
• Processing your subscription and billing — performance of the contract and compliance with legal tax obligations.
• Sending appointment reminders by email/WhatsApp to patients, at the professional's request — performance of the contract between the professional and the patient, through Nerela as processor.
• Security and error detection — legitimate interest in keeping the service running reliably and securely, with personal-data scrubbing (section 9).
• Measuring and optimising our ads on Google and Meta — your consent (Article 6(1)(a) of the GDPR and, for cookies, ePrivacy rules), which you can withdraw at any time from the “Cookies” link in the website footer.
• Knowing which campaign or link each sign-up came from, using the own-measurement cookies described in the Cookie Policy — legitimate interest in measuring the effectiveness of our own advertising without sharing that data with third parties.

5. How long we keep data

While your account is active, we keep the data needed to provide the service. Once you cancel, we delete or anonymise it within a reasonable period, except where there's a legal obligation to keep it longer (for example, tax documentation for your subscription).

Your patients' clinical records have their own retention periods, set by law and by your professional body's rules. As the controller for that data, you're the one who has to meet those retention periods: if you need to keep information beyond the life of your account, talk to us before cancelling (admin@nerela.eu).

6. Who we share data with (subprocessors)

We don't sell data to anyone. We only share data with the providers we need to operate the service, each with their own data protection commitments — see the table at the end of this page. Meta is not a processor and so is not in the table: if you accept advertising on the website, it receives the pixel data as a controller (section 11).

7. International transfers

The clinical data you keep in Nerela — patient records, appointments, session notes and attached images — is stored in Supabase (database, authentication and file storage), in the EU region of Paris, France (eu-west-3). The App's server code runs on Vercel, also in Paris (region cdg1); static assets and request routing go through Vercel's global network.

Some providers process data in the United States, and we'd rather say so clearly than claim there are none. Resend sends the App's emails (appointment reminders and invitations, invoices, reports for your accountant and notices to you) and processes that data in the United States. Twilio is only involved if you use WhatsApp (WhatsApp reminders or the Virtual Secretary) and processes the messages in the United States, its default region. Stripe charges your subscription and, if you turn it on, your patients' card payments, from Ireland and with transfers to the United States. Anthropic is only involved if you enable the Virtual Secretary: the AI model that drafts WhatsApp replies needs to read the messages in that conversation. None of these providers receives your session notes.

If we turn on error monitoring (Sentry), error reports — filtered before they leave our server (section 9) — may be processed in the United States, depending on the project's region. Each transfer outside the EEA relies on a safeguard under Chapter V of the GDPR — the EU-U.S. Data Privacy Framework or the Standard Contractual Clauses approved by the European Commission — shown in the table at the end of this page.

If you accept advertising on the website, Meta Platforms Ireland Limited (Ireland) receives the Meta pixel data (section 11) and may transfer it to the United States, under a Chapter V GDPR safeguard: the EU-U.S. Data Privacy Framework or the Standard Contractual Clauses approved by the European Commission.

8. Your rights

If you're a professional with a Nerela account, or a patient of a professional who uses it, you have the right to access, rectify, erase, restrict the processing of, object to, and port your personal data. If you're a patient, your request should normally be directed to your professional first (the controller for your clinical data); we provide technical support for that request.

To exercise these rights over your professional account data, write to admin@nerela.eu. You can view, correct and delete your patients' data directly in the App. For portability, you can export the data from Settings, in the privacy and data section, once that option is available in your account, or ask us for a copy at admin@nerela.eu, which we'll send you within 30 days in a structured, commonly used format.

9. Security and error monitoring

Data in transit is always encrypted (HTTPS/TLS). Isolation between professionals is enforced at database level (Row Level Security in Supabase), not just in the application.

If we enable Sentry (error monitoring), it's configured with a strict privacy policy: we don't send request bodies, query parameters, session cookies, or session-note content. We don't use session recording ("session replay") or any visual screen capture. Error messages pass through a filter that automatically tries to strip out emails, phone numbers and tax ID numbers before they leave our server.

10. Minors

Nerela is a tool for professionals, not for direct use by patients who are minors. Data on patients who are minors may be processed by the professional responsible for their care, under the same legal basis that applies to the therapeutic relationship.

11. Visitors to our websites: advertising and measurement

On nerela.eu and nerela.lat — the public website; the app.nerela.eu application carries no advertising — the data controller is the company in section 1. Without your permission we only keep the campaign or link you arrived from (the nerela_attrib and nerela_utm cookies, described in the Cookie Policy), so we know what brings each sign-up.

If you accept advertising in the cookie notice, we measure and optimise our ads with Google Ads and with the Meta pixel (Facebook and Instagram). The Meta pixel is only loaded after you accept advertising, and it sends Meta your browser identifiers (the _fbp and _fbc cookies and, if you arrive from an ad, the Facebook click identifier), your IP address, your browser, the page you visit and the visit events: viewing the page, pressing the sign-up button or pressing the WhatsApp button. We send Meta nothing from the application and no patient data. The legal basis is your consent (Article 6(1)(a) of the GDPR), which you can withdraw whenever you like from the “Cookies” link in the website footer, without affecting processing carried out before.

If you have accepted advertising and then create an account, our server may tell Meta that you signed up, with no clinical data, so we can measure which ad produced the sign-up: it uses the browser identifiers above and the account's contact details, hashed before they leave our server. If you did not accept advertising, nothing is sent.

Meta is not our processor: for the pixel data it acts as a controller, either independently or jointly with us depending on the stage of the processing, and it handles that data under its own terms and its privacy policy. To exercise your rights over the data in this section, write to admin@nerela.eu.

12. Changes to this policy

We may update this policy to reflect changes to the service or to applicable law. Material changes are communicated by email or through a notice in the App.

13. Supervisory authority

You have the right to lodge a complaint with the competent supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD); in Spain, the Agencia Española de Protección de Datos (AEPD) — without prejudice to any other administrative or judicial remedy.

14. Contact

For any question about this policy or about how we process your data, write to admin@nerela.eu. You'll be writing to the same company named in section 1.